From here
 | | |
| Quote: These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9, 10 and 11, bypassing its sandbox | |
| | |
This is live now and actively being used for some incredibly cool spyware. There's a fairly detailed analysis of this complicated and carefully planned attack on the link.
- Mitigation and recommendations
- Update Java to the latest version or simply remove it from
the system if not used - Update Microsoft Windows and Office to the latest versions
- Update Adobe Reader to the latest version
- Block traffic to the following domains:
arabooks.ch
artas.org
tsoftonline.com
www.eamtm.com
news.grouptumbler.com - Block traffic to the following IPs:
200.63.46.23
194.38.160.153
95.128.72.24
72.34.47.186
188.40.99.143
85.95.236.114 - Install a security solution capable of detecting these threats such as Kaspersky Internet Security 2013 and scan all
emails and received documents - Be wary of opening suspicious documents on your systems; instead, use another computer without an Internet
connection, a VM, or upload the document to Google Docs for viewing
In addition, infected PDFs contain the following string, which can be used as a quick way to find them:
“@34fZ7E*p\”
To protect against these attacks, we recommend that you:
